Apparatus And Method For Detecting A Cloned Base Station

ABSTRACT

Communications are established between a base station and a mobile unit. The mobile unit analyzes the content of at least some information received from the base station relating to neighboring cells. When the analyzing indicates that the base station is a cloned base station, a warning is initiated to the user.

CROSS REFERENCES TO RELATED APPLICATIONS

“Apparatus and Method of Detecting Jamming of Communications” havingattorney docket number DP10050 (93738)

“Apparatus and Method for Broadcasting the Detection of RF JammerPresence” having attorney docket number DP10051 (94690)

“Apparatus and Method for Compromised Vehicle Tracking” having attorneydocket number DP10052 (94691)

“Apparatus and Method for detecting Communication Interference” havingattorney docket number DP10054 (93739)

“Apparatus and Method for Detecting a Cloned Base Station” havingattorney docket number DP10055 (93741)

“Apparatus and Method for Determining an Invalid Base Station” havingattorney docket number DP10056 (97058)

“Apparatus and Method for Determining Vehicle Location” having attorneydocket number DP10057 (97059)

“Apparatus and Method for Maintaining Communication with a StolenVehicle Tracking Device” having attorney docket number DP10058 (97060)

“Apparatus and Method for Reducing False Alarms in Stolen VehicleTracking” having attorney docket number DP10059 (97061)

“Apparatus and Method for Tracking Stolen Vehicles” having attorneydocket number DP10060 (97062)

“Apparatus and Method for Maintaining Communications with a Vehicle inthe Presence of Jamming” having attorney docket number DP10061 (97102)

all of which are being filed on the same date as the present applicationand all of which having their contents incorporated herein by referencein their entireties.

FIELD OF THE INVENTION

The field of the invention relates to communications and morespecifically to detecting the presence of cloned base stations.

BACKGROUND

Vehicles are equipped with various types of communication systems thatprovide or facilitate various types of functions. For instance, avehicle may be equipped with a Global Positioning Satellite (GPS)location determination system that communicates with a GPS satellite andprovides the ability to locate and track the vehicle. Vehicle securitysystems are also widely used in vehicles today. For example, a securitysystem may communicate with an outside entity and when an attempt ismade to break into a vehicle, the security system may attempt to warn aprivate security center (or some other appropriate entity such as thepolice) that a break-in is occurring. Some jurisdictions require the useof vehicle security systems because of the high number of vehiclebreak-ins or thefts in these areas.

Stolen vehicle tracking (SVT) applications also exist where a vehicle isprovided with components that can detect if a vehicle is stolen and/orassist in the tracking of the stolen vehicle. Many SVT approaches relyupon GPS technology to pinpoint the location of the vehicle and a GlobalSystem for Mobile communications (GSM) cellular network to report theincident to a service provider via Short Messaging Service (SMS) orGeneral Packet Radio Service (GPRS) data connection. Other examples ofconnections and protocols can be used.

Potential vehicle thieves have sometimes attempted to jam the receiverhardware at the vehicle by using a device that creates a strongwide-band signal in the receive band to block the GPS satellite and GSMnetwork signals to the vehicles. In so doing, the theft of the vehiclecould not be detected or reported.

In other examples, thieves or other criminals attempted to clone basestations. That is, the services of a base station are imitated bydevices provided by the criminal and once a user (or the user's device)establishes communication with the cloned base station, the user ordevice incorrectly believed that the cloned base station was a validbase station. Thus, among other problems, the vehicle's security systemwere often fooled into sending warning messages to an invalid basestation, no action was taken by the cloned base station (since it wasprovided by the criminal), and the vehicle was stolen without detection.Previous attempts at detecting jamming, detecting the presence of clonedbase stations, and reporting these occurrences to a security center havegenerally been unsuccessful, slow, and/or expensive to accomplish.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 comprises a block diagram of a system for detecting the presenceof a cloned base station according to various embodiments of the presentinvention;

FIG. 2 comprises a block diagram of an apparatus for detecting thepresence of a cloned base station according to various embodiments ofthe present invention;

FIG. 3 comprises a flow chart of an approach for detecting the presenceof a cloned base station according to various embodiments of the presentinvention;

FIG. 4 comprises one example of a base station allocation tableaccording to various embodiments of the present invention;

FIG. 5 comprises a flow chart of an approach for detecting the presenceof a cloned base station according to various embodiments of the presentinvention.

Skilled artisans will appreciate that elements in the figures areillustrated for simplicity and clarity and have not necessarily beendrawn to scale. For example, the dimensions and/or relative positioningof some of the elements in the figures may be exaggerated relative toother elements to help to improve understanding of various embodimentsof the present invention. Also, common but well-understood elements thatare useful or necessary in a commercially feasible embodiment are oftennot depicted in order to facilitate a less obstructed view of thesevarious embodiments of the present invention. It will further beappreciated that certain actions and/or steps may be described ordepicted in a particular order of occurrence while those skilled in theart will understand that such specificity with respect to sequence isnot actually required. It will also be understood that the terms andexpressions used herein have the ordinary meaning as is accorded to suchterms and expressions with respect to their corresponding respectiveareas of inquiry and study except where specific meanings have otherwisebeen set forth herein.

DETAILED DESCRIPTION

Approaches are provided where a cloned base station is detected and itsdetection is reported to a user so that appropriate action can be taken.The approaches described herein are accurate in determining whether thesuspect base station is actually a cloned station, and timely in thatthey allow for the detection of a cloned base station before a vehicleand/or its contents can be stolen. The approaches described herein caneasily be retrofitted into existing systems thereby avoiding the needfor costly re-wiring or re-working of existing systems.

In many of these embodiments, communications are established between abase station and a mobile unit. The mobile unit analyzes the content ofat least some information received from the base station relating toneighboring cells. When the analyzing indicates that the base station isa cloned base station, a warning is initiated to the user.

In some aspects, an allocation table is stored in a memory storagedevice and the allocation table includes information related to theoperating environment (e.g., signal strength levels of communicationchannels) of a user. The content of the allocation table is analyzed anda determination is made as to when the base station is a cloned basestation based upon the analysis.

In other aspects, a Neighbor Cell List (or other information) isreceived and the analysis includes measuring the power level of at leastone neighbor channel identified in the Neighbor Cell List anddetermining whether the base station is a cloned base station based uponthe analysis. A warning can be initiated when the power level of the atleast one neighbor channel is substantially zero. Alternatively, thepower level of the current serving cell may be determined and a warningonly initiated when the power level of the current serving cell is abovea predetermined level and the power level of the at least one neighborchannel is substantially zero.

In still other aspects, a Neighbor Cell List is expected to be receivedat the mobile unit. A determination is made as to whether a NeighborCell List has been received and a warning is initiated when the NeighborCell List has not been received by the mobile unit.

In others of these embodiments, communications are established andengaged in with a base station. The communications may be establishedbetween an apparatus and a base station and, in some examples, theapparatus is disposed in or at a vehicle. However, it will beappreciated that the apparatus need not be at or in a vehicle, but couldbe at other locations as well. And, it will be appreciated that althoughthe approaches described herein are described as generally related toand providing vehicular security, they can also be deployed in otherenvironments and for other purposes as well.

An allocation table is stored in a memory storage device at theapparatus and the allocation table includes information related to theoperating environment of a user or the apparatus. For example, theallocation table (or other data structures stored at the memory storagedevice) may identify channels, appropriate or desired signal strengthlevels for these channels, and whether these channels are in use.Predetermined or pre-assigned channels may be used in communicationswith the base station while other channels may be not assigned orforbidden for use. The content of the allocation table is analyzed and adetermination is made as to when the base station is a cloned basestation based upon the analysis.

When the analysis indicates that the base station is a cloned basestation, a warning is presented to the user. As used herein, theexpression “user” will be understood to be an end user of the protectedvehicle, or a party authorized or charged to protect the vehicle (suchas an off-site alarm center), and so forth.

In some of these examples, the determination that the base station is acloned base station is based upon a heightened signal strength levelassociated with a channel or channels stored in the table (or other datastructure). As used herein, “signal strength level” refers to a numericvalue representing the strength of a received signal (e.g., in terms ofreceived power). Specific examples of signal strength level included theRx Level. As used herein, “heightened” means a level that exceeds apredetermined threshold. This threshold generally exceeds the signalstrength value associated with ordinary use. In other examples, thedetermination of whether a clone exists is based upon analyzing the basestation allocation (BA) table for the identity of channel(s) in use andif a channel(s) is being used but has not been assigned for use, it isassumed that a cloned base station is using the channel. In anotherexample, the determination of whether the base station is a cloned basestation is based upon determining whether a neighboring cell exists inthe allocation table and when no neighboring cell exists it is assumedthe base station is a cloned base station.

As used herein “operating environment” refers to the identity andproperties of the communication channels used to communication betweenthe apparatus and the base station and/or the identity and properties ofthe particular cell where the apparatus/user currently resides, the homecell of the apparatus or user, other neighboring cells, and so forth. Inthis regard, the operating environment may include the identity of atleast one neighboring cell and the determination as to whether cloningexists may include determining when at least one signal strength value(e.g., a Rx Level value) associated with the at least one neighboringcell is a suspect value. In some of these examples, the apparatusmeasures signal strength levels on the channels on the Neighbor CellList and these sensed levels are used to populate the table.Alternatively, the apparatus may omit use of the table and directlymeasure signal strength levels on channels identified in a receivedNeighbor Cell List.

The determination of whether the at least one signal strength value is asuspect value may include determining that the at least one signalstrength value increases at a rate greater than a predeterminedthreshold rate. In other examples, the suspect value may be zero orapproximately zero, indicating a low received signal strength, near thesensitivity level of the receiver. Other examples of suspect values thatidentify a cloned base station are possible.

In others of these examples, the base station is a valid base stationand communications are established with a cloned base station subsequentto establishing communications with the valid base station. In stillother examples, communications are established with a cloned basestation before communications are established with a valid base station.

In others of these embodiments, the presence of a cloned base station isdetected. At a vehicle, communications are established with a basestation and communications engaged with the base station from thevehicle. An allocation table is stored in a memory storage device at thevehicle and the allocation table includes information related to theoperating environment of the vehicle. The content of the allocationtable is analyzed for a presence of at least one neighboring cell and adetermination is made as to when the base station is a cloned basestation based upon the analysis. When the analyzing indicates that thebase station is a cloned base station, a warning is initiated andpresented to a user at the vehicle. In some of these examples, thedetermination of whether the base station is a cloned base station whenno neighboring cell exists in the allocation table. Alternatively, thetable can be omitted and determination made from information receivedfrom a base station (e.g., a Neighbor Cell List may identify channelsand the device may directly measure the received signal strength levelsof the channels without consulting the table). In still other examples,some or all of the allocation table may be downloaded from anotherlocation (e.g., a base station or other mobile unit).

In some examples, the operating environment represented in the table mayinclude or identify at least one neighboring cell and the determinationas to whether a cloned base station exists may include determining whenat least one signal strength value associated with the at least oneneighboring cell is a suspect value. The suspect value may be indicatedwhen the at least one signal strength value increases at a rate greaterthan a predetermined threshold rate. In other examples, the suspectvalue may be zero or approximately zero.

In still others of these embodiments, an apparatus detects the presenceof a cloned base station and the apparatus includes a communicationinterface, a memory, a warning indicator, and a controller. Thecommunication interface is configured to establish and engage incommunications with a base station. As used herein, a “base station” isany transmitting and receiving device capable of transmittingcommunications with an electronic device using any communicationchannel, frequency, or protocol. In one example, a base station is ofthe type typically deployed in cellular communication systems. However,it will be understood that any type of base station communicating at anyfrequency and/or any communication protocol as known to those skilled inthe art may be used.

The memory is coupled to the communication interface and includes anallocation table. The allocation table includes information related tothe operating environment of the user or apparatus. The memory can alsostore computer instructions that implement any of the approachesdescribed herein.

The controller is coupled to the communication interface, the memory,and the warning indicator. The controller is configured to analyze thecontent of the allocation table and to determine when the base stationis a cloned base station based upon the analysis. The controller isfurther configured to, when the analyzing indicates that the basestation is a cloned base station, initiate or present a warning to theuser via the warning indicator.

In some examples, the controller is configured to determine that thebase station is a cloned base station when no neighboring cell exists inthe allocation table. In other examples, the determination that the basestation is a cloned base station is based upon a heightened signalstrength level associated with a channel as indicated by the allocationtable. In other examples, the determination that the base station is acloned base station is based upon when there are neighbors in theallocation table but all of the power levels are zero and the servingcell power level is above a predetermined threshold. In still otherexamples, the determination as to whether a base station is a clonedbase station is based upon determining whether a particularcommunication channel is in use and whether use of this channel isauthorized. Other examples are possible.

The warning indicator may be a number of devices or use a variety ofapproaches. In one example, the warning indicator comprises an audiospeaker. In another example, the warning indictor is a visual indicator(e.g., flashing headlights, light emitting diodes (LEDs), or the like).

Referring now to FIG. 1, one example of a system for detecting a clonedbase station that is in communication with or is attempting to establishcommunications with vehicles or systems present in vehicles isdescribed. Although the examples described herein relate to vehicularcommunications or the tracking of vehicles, it will be appreciated thatthese approaches are not limited to devices deployed at or in vehiclesand are specifically not limited to providing vehicular security. To thecontrary, these approaches may be deployed at any location and providesecurity for any type of entity.

As shown in FIG. 1, a vehicle 102 includes a communication device 104.The communication device 104 communicates with a base station 106. Thecommunication device 104 determines if the base station 106 is a clonedbase station by analyzing an allocation table stored at thecommunication device 104. In this respect, the communication device 104may be implemented by any combination of hardware and programmedsoftware to implement this or other functions. The communication device104 communicates with entities outside the vehicle 102 using any type ofcommunication technology or protocol.

Besides the detection of cloned base stations, the communication device104 may perform other functions and/or be incorporated into an existingdevice. In this respect, the communication device 104 may be a cellularphone, transponder, radio, or some combination of these or otherdevices. In other examples, the communication device 104 is not part ofan existing device, but is deployed as a stand-alone unit including aseparate housing structure or enclosure (apart from other portabledevices that may be present in the vehicle 102). In this case, thecommunication device 104 may be communicatively coupled to andcommunicate with other devices (e.g., cellular phones).

The vehicle 102 may be any type of vehicle such as a car, truck, bus,airplane, ship, to name a few examples that are used to transport one ormore persons. However, as mentioned above, these approaches are notlimited to in-vehicle environments and applications and may be used inother environments such as homes and businesses to name two examples.

The base station 106 is any type of base station as known to thoseskilled in the art. In this respect it may be a cellular base stationsuch as Model KRC 131 1002/2 R5F manufactured by Ericsson. Otherexamples of base stations are possible. In others of these examples, thebase station 106 is a valid base station and communications areestablished (or are attempted to be established) with a cloned basestation subsequent to establishing communications with the valid basestation.

In one example of the operation of the system of FIG. 1, communicationsare established between the device 104 and the base station 106. Anallocation table is stored in a memory storage device at the device 104and the allocation table includes information related to the operatingenvironment of a user of the vehicle 102 and/or the device 104. Forexample, the allocation table may identify neighboring cells, the homecell of the user, communication channels, signal strength levels ofthese channels (e.g., a Rx Level value), and whether these channels arein use or authorized for use to name a few examples. With regard toauthorized channels, predetermined channels may be used incommunications with the base station 106 while other channels are not tobe used (i.e., not assigned). If the not-to-be used channels are in factbeing used, then it may be assumed (in some examples) that a cloned basestation is present and using these channels. In these examples, thedevice 104 measures signal strength levels on the channels oninformation received from a base station (e.g., a Neighbor Cell List)and these sensed levels are used to populate the table. Alternatively,the apparatus may omit use of the table and directly measure signalstrength levels on channels identified in received information from abase station (e.g., a Neighbor Cell List).

Selected contents of the allocation table at the device 104 are analyzedand a determination is made by the device 104 as to when the basestation 106 is a cloned base station based upon the analysis. Theanalysis may be a simple look-up of information contained in the tableor may involve further processing (e.g., the use of equations,comparisons of values from the table, and so forth). When the analysisindicates that the base station 106 is a cloned base station, a warningis initiated and presented to the user. As used herein and as mentionedelsewhere herein, the expression “user” will be understood to an enduser of the protected vehicle, or a party authorized or charged toprotect the vehicle (such as an off-site alarm center), and so forth.

In some of these examples, the determination that the base station 106is a cloned base station is based upon a heightened signal strengthlevel on a channel or channels as indicated in the allocation table. Asused herein, “heightened” means a level that exceeds a predeterminedthreshold. This threshold generally exceeds the signal strength valueassociated with ordinary use. For example, the unit may be sitting idleand monitoring the serving cell and neighbors which are all at a fairlyconsistent Rx Level. If one of the neighbor's Rx Level suddenly startsto rise, this could indicate the presence of a malicious base stationthat has been set up on this neighbor channel. The unit may attempt toperform a cell reselection to the malicious base station unlessprecautions are taken. In other examples, the determination of whether acloned base station exists is based upon analyzing the base stationallocation table for the identity of channel(s) in use and if thechannel(s) in use are not assigned for communications (i.e.,communications are occurring on a forbidden or unauthorized channel), itis assumed that a cloned base station exists and is using the channel.In another example, the determination of whether the base station 106 isa cloned base station is based upon determining whether a neighboringcell exists in the allocation table and when no neighboring cell existsassuming a cloned base station exists. In another example, thedetermination of whether the base station 106 is a cloned base stationis based upon determining when there are neighbors in the allocationtable but all the power levels are zero and the serving cell power levelis above a predetermined threshold.

The determination of whether the at least one signal strength value is asuspect value may include determining that the signal strength valueincreases at a rate greater than a predetermined threshold rate. Forexample, the unit may be sitting idle and monitoring the serving celland the neighbors which are all at a fairly consistent Rx Level. If oneof the neighbor's Rx Level suddenly starts to rise greater than somevalue, e.g., 6 dB of its static value, this could trigger the indicationof a malicious base station. In other examples, the suspect value may bean approximate zero value. Other examples of suspect values arepossible.

In others of these examples, the base station 106 is a valid basestation and communications are established with a cloned base stationsubsequent to establishing communications with the valid base station.In still other examples, communications are established with a clonedbase station before communications are established with a valid basestation.

In other examples, communications are established between the basestation 106 and the device 104. The device 104 analyzes the content ofat least some information received from the base station relating toneighboring cells. When the analyzing indicates that the base station106 is a cloned base station, a warning is initiated to the user.

In some aspects, an allocation table is stored in a memory storagedevice at the device 104 and the allocation table includes informationrelated to the operating environment of a user. The content of theallocation table is analyzed and a determination is made as to when thebase station 104 is a cloned base station based upon the analysis. Theallocation table may be constructed from information received in aNeighbor Cell List (that identifies channels) and from information thatthe device itself senses (e.g., signal strength information concerningthe channels identified in the list).

In other aspects an allocation table is not consulted. For example, aNeighbor Cell List is received at the device 104 and the analysisincludes determining a first power level of at least one channelincluded with the Neighbor Cell List and determining when the basestation 106 is a cloned base station based upon the analysis. Thedetermination may include having the device 104 sense the power levelsidentified in the Neighbor Cell List. A warning when the first powerlevel of the at least one channel is substantially zero. Alternatively,a second power level of the current serving cell may be determined and awarning initiated when the second power level of the current servingcell of the device 104 is above a predetermined level and the firstpower level of the at least one channel is substantially zero.

In still other aspects, a Neighbor Cell List is expected to be receivedat the device 104. A determination is made as to whether a Neighbor CellList has been received and a warning is initiated when the Neighbor CellList has not been received at the device 104.

Various actions can be taken once jamming or the detection of a roguebase station occurs. As mentioned, a warning message can be transmittedto an emergency reporting center 108. The emergency reporting center 108(e.g., the police or a private security provider) is coupled to the basestation 106. For example, this warning message may be transmitted over aGSM network. In other examples, other frequencies and/or other types ofnetworks in addition to or instead of the GSM network can be used totransmit the warning message (and/or transmit or receive othercommunications). For example, warning messages may be transmitted at FMRadio Data System (RDS) frequencies, over Wireless Local Area networkssuch as Wi-Fi networks, over infrared (IR) networks, Bluetooth (BT)networks, to “amber alert” stations (e.g., using the Emergency AlertSystem (EAS) or Emergency Broadcast System (EBS)), over WorldwideInteroperability for Microwave Access (WiMAX) networks, over CodeDivision Multiple Access/Integrated Digital Enhanced Network (CDMA/IDEN)systems, and/or over Advanced Mobile Phone System (AMPS) networks. Inaddition, Morse code (or some other coding approach) may be transmittedusing the horn and/or headlights of the vehicle 102 (or some otherdevice in the vehicle). In still other examples, a short messagingservice (SMS) cell broadcast is made once jamming is detected. Otherexamples are possible.

Broadcast FM RDS uses a sub-carrier to communicate digital informationto the user's radio and to the user. The information for the user istext, such as the station call sign, and is usually presented to theuser on the display of the car radio. In the present approaches, RDS maybe used to carry a warning message would be to have the SVT unittransmit an RDS message on one or more broadcast FM channels with a textmessage such as “Help! Stolen Car: silver Chevy license 997 KLM”. Thismessage would be received in the vicinity of the stolen vehicle andcould be seen by drivers whose cars are in the vicinity of the stolenvehicle. Even though nearby drivers are listening to a standardbroadcasting station on the same frequency, the signal from the SVT unitwould be received due to its higher signal strength at the receiver dueto the small separation distance. One of these drivers could then make acall to the police or some other authority. Due to the short rangenature of the communications, the stolen vehicle would be in thevicinity of this person's car.

A security beacon can be activated once jamming is detected. Forexample, a security beacon such as those manufactured by the LoJackCorporation can be used. The security beacon transmits signals that canbe detected and used to locate the vehicle 102. The security beacon canbe used in addition to or in place of the communications (e.g., warningmessages) that are transmitted, for example, over GSM systems.

In another example, the communication device 104 can transmit a periodic(or non-periodic) “pinging” signal to a server (e.g., a schemavalidation tool (SVT) server). If the server detects no pinging signal,it may assume that the vehicle is stolen. The server, in this example,is external to the vehicle 102.

Any number of antennas may be used by the communication device 104. Inone example two antennas are used and one antenna is used to transmitsignals and the other is used to receive signals. In other examples,multiple TX and RX antennas can be used with some of the antennas beingused as backup antennas. If the path loss abruptly changes, then thedevice can switch antennas. In one aspect, when jamming is occurring (ordetected to be occurring) then the device can switch antennas andattempt to communicate on the backup antenna or backup antennas. Instill other examples, a single antenna is used.

In another aspect, once jamming or the presence of a rogue base stationare detected various actions can be taken that affect the operation ofthe vehicle and/or a driver's ability to successfully drive the vehicle102. In these examples, it is assumed that the detection of jammingdenotes an attempt by a criminal to steal the vehicle 102 and/or itscontents. Consequently, these approaches attempt to stop the theft ofthe vehicle 102 and/or its contents by adversely affecting the operationof the vehicle so that the criminal has a difficult or impossible timeoperating the vehicle 102. For example, the radio operation can bechanged (e.g., by setting its sound level to a deafening level), theoperation of the lights of the vehicle can be adjusted (e.g., bydeactivating the lights at night), the operation of the horn can bealtered (e.g., by activating the horn), the operation of the stabilitycontrol system can be altered (e.g., to cause unstable operation), theseat location can be adjusted (e.g., by moving the seat to anuncomfortable position), the operation of heat controlled seats can bechanged (e.g., by setting a temperature that is uncomfortable orscalding to a driver), the steering wheel operation can be altered(e.g., by locking the steering wheel), the temperature of the vehicleinterior can be changed (e.g., by setting the temperature to anuncomfortable hot or cold setting), and/or the tone of an audible devicecan be altered (e.g., to produce a deafening tone) based upon thedetection of jamming to thereby make theft of the vehicle and/or itscontents difficult or impossible for the thief to achieve.

In some examples, areas of known good signal strength are located by thecommunication device 104 and/or some external device or system. If thesignal from the device stops without the vehicle moving, jamming isdetermined to be occurring. In other aspects, areas of known good signalstrength are determined (e.g., a known good signal strength for aparticular area, time, or other parameter), and if the signaltransmitted from the device varies significantly (e.g., beyond athreshold amount) from expected levels jamming is determined to beoccurring. The threshold can be based upon map data provided by a systemor device that is disposed external to the communication device 104and/or developed by the device 104 from previous readings (e.g.,previous drives) to name two approaches. The thresholds can be loadedinto the device 104.

In other aspects, the location of the vehicle 102 can be tracked even asjamming is occurring. For instance, Rx Level and/or Rx Qual readings(e.g., reported by one or more communication devices to an externalservice center) may be used to identify and/or confirm jammer presenceand pinpoint location of the vehicle 102, for example, usingtriangulation approaches.

In some aspects, the communication device may authenticate the basestation 106. For example, various hand-shaking approaches may be used bythe communication device to authenticate the base station 106.

Referring now to FIG. 2, an apparatus 200 that detects the presence of acloned base station is described and includes a communication interface202, a memory 204, a warning indicator 206, and a controller 208. Thecommunication interface 202 is configured to establish and engage incommunications with a base station 212 and may include any combinationof electronic hardware and programmed software.

The memory 204 is coupled to the communication interface 202 andincludes an allocation table 210. The allocation table 210 includesinformation related to the operating environment of a user. Varioustypes of information may be included in the table. In one example, theallocation table includes the identity of at least one neighboring cell.The table may also include identities of communication channels used,the identity of the home cell of the device, channels assigned forcommunication to the base stations, channels not assigned forcommunication to the base stations, signal strength levels (e.g.,maximum or minimum values allowed), and so forth. Other types ofinformation may also be included or be associated with the allocationtable and stored either with the allocation table or elsewhere inmemory. The memory 204 may also store computer instructions thatimplement any of the approaches described herein.

The controller 208 is coupled to the communication interface 202, thememory 204, and the warning indicator 206. The controller 208 isconfigured or programmed to analyze the content of the allocation tableand to determine when the base station 212 is a cloned base stationbased upon the analysis. The analysis may include comparing values inthe table to thresholds, to name one example.

The controller 208 is further configured to, when the analyzingindicates that the base station 212 is a cloned base station, a warningis initiated and presented to the user via the warning indicator 206.The warning indicator 206 may be a number of devices or use a variety ofapproaches. In one example, the warning indicator 206 comprises an audiospeaker. In another example, the warning indictor 206 is a visualindicator (e.g., headlights, LEDs, or the like). Other examples andcombinations are possible. The controller 208 may also communicate (viathe interface 202) with other entities such as the police or privatesecurity centers to name two examples and provide warnings to theseentities.

The controller 208 may determine that cloning exists in a variety ofdifferent ways. For example, the controller 208 may determine when atleast one signal strength value associated with the at least oneneighboring cell is a suspect value. When this event occurs, a warningmay be sent to the user that a cloned base station has been detected.The determination of whether the at least one signal strength value is asuspect value may include determining that the at least one signalstrength value increases at a rate greater than a predeterminedthreshold rate. For example, if the signal strength measured on all ofthe channels for the neighbor cells is the same (or substantially thesame), this made indicate that jamming is occurring. In other examples,the suspect value may be an approximate zero value, indicating a lowreceived signal strength, near the sensitivity level of the receiver.Other examples of suspect values are possible.

In some examples, the controller 208 is configured to determine that thebase station 212 is a cloned base station when no neighboring cellexists in the allocation table. In other examples, the determinationthat the base station is a cloned base station is based upon aheightened signal strength level associated with a channel in theallocation table. In still other examples, the determination as towhether the base station 212 is a cloned base station is based upondetermining whether a particular communication channel is in use.

In yet other examples, the allocation table 210 can be examined and ifall received signal strength levels for all channel entries in the tableare zero, a cloned base station may be determined. In still otherexamples, if the apparatus 200 is in motion and the signal strengthlevels of the serving cell does not change by a predetermined thresholdor after driving a certain distance no cell reselections have beenperformed, a warning can be initiated. Other examples are possible.

In other aspects, a Neighbor Cell List is received by the controller 208and the controller determines whether a first power level of at leastone channel on the list is suspect (e.g., substantially zero). A warningwhen the first power level of the at least one channel is suspect.Alternatively, a second power level of the current serving cell may bedetermined and a warning only initiated when the second power level ofthe current serving cell is above a predetermined level and the firstpower level of the at least one channel is substantially zero.

In still other aspects, a Neighbor Cell List is expected to be receivedby the controller 208. A determination is made as to whether a NeighborCell List has been received by the controller 208 and a warning isinitiated when the Neighbor Cell List has not been received by thecontroller 208.

Referring now to FIG. 3, one example of an approach for detecting theexistence of a cloned base station is described. At a vehicle, at step302 communications are established with a base station andcommunications engaged with the base station from the vehicle. Forexample, a registered mobile may establish service with a base stationaccording to techniques that are well known to those skilled in the art.An allocation table is stored in a memory storage device at the vehicleand the allocation table includes information related to the operatingenvironment of the vehicle. For example, the operating environment mayinclude at least one neighboring cell. A Neighbor Cell List including alist of the channels of the base stations in the cells nearby this cell,may be received from the base station. Other examples of information mayalso be stored in the allocation table. The table may be stored in anytype of data structure such as a table, linked list, and so forth.

At step 304, some or all of the content of the allocation table isanalyzed. This step may be performed by a simple look-up of informationfrom the table in some examples. However, in other examples, informationmay be obtained from the table and further processed. In this regard andto take one example, information from the table may be obtained (e.g., asignal strength indicator value) and compared to a predeterminedthreshold (e.g., a maximum threshold) stored at the table or elsewherein memory.

At step 306, a determination of whether the base station is a clonedbase station is made based upon the analysis. In some examples, thecontroller is configured or programmed to determine that the basestation is a cloned base station when no neighboring cell exists in theallocation table. This determination could be made by the unit when itreceives an empty Neighbor Cell List from the base station. Thisdetermination could also be made if the Neighbor Cell List is missingfrom the broadcast control channel sent from the base station. In otherexamples, the determination that the base station is a cloned basestation is based upon a heightened signal strength level associated witha channel in the allocation table. In still other examples, thedetermination as to whether a base station is a cloned base station isbased upon determining whether a particular communication channel is inuse. Other examples are possible.

At step 308, when the analyzing indicates that the base station is acloned base station, a warning is initiated and presented to a user atthe vehicle. As mentioned, the warning indicator may be or include anaudio speaker. In another example, the warning indictor may be a visualindicator (e.g., lights, LEDs, or the like). Other examples andcombinations of warning indicators are possible. The apparatus may alsocommunicate with other entities such as the police or private securitycenters to name two examples and provide warnings to these entities.

Referring now to FIG. 4, one example of an allocation table 400 isdescribed. The allocation table 400 is a base allocation (BA) table thatis a list of channels of all serving cells in the immediate area of amobile unit at the vehicle. For example, the first entry is the servingcell and in this case the unit has service on channel 975. The basestation corresponding to channel 975 has informed the unit that thereare base stations in the immediate area on channels 1, 10, 24, 32, and56. In normal operation, it is the unit's responsibility to measure thesignal strengths on these neighbors and report the strongest values(e.g., the strongest six values) to the base station. It is the decisionof the base station as to whether or not to hand over the unit to one ofthese other cells to be initiated. For example, the table of FIG. 4shows signal strength measurements as they might occur before the clonedbase station is activated. If a criminal attempts to set up a clone onchannel 24, the Rx Level of this cell will likely appear to increasefrom 12 to some much higher value while the vehicle is not moving. Ifthis value increases over a certain threshold such as 12 dB, then aclone has been detected.

Referring now to FIG. 5, another example of an approach for determiningthe existence of a cloned base station is described. At step 502, it isdetermined whether a Neighbor Cell List (or other information) has beenreceived at the mobile unit (e.g., the device 104 of FIG. 1). If theanswer is negative, then execution continues at step 514 where thedetermination is made that the base station is suspect and a warninginitiated.

If the answer at step 502 is affirmative, at step 504 the power levelsof each of the channels listed in the Neighbor Cell List are sensed bythe mobile unit. At step 506, it is determined whether all (or apredetermined number of these levels) are zero. If the answer isnegative, control continues at step 508 where the base station isdetermined not to be suspect and no warning is initiated.

If the answer at step 506, is affirmative, then at step 510 the powerlevel of the serving cell of the mobile unit is sensed. At step 512, itis determined if this value is above a sensed threshold. If the answeris negative, execution continues at step 508 as described above. If theanswer is affirmative, then execution continues at step 514 as describedabove. It will be appreciated that steps 510 and 512 can be omitted andthat a base station may be viewed as suspect if the power on all (or apredetermined number) of the channels in the Neighbor Cell List is zeroor substantially zero.

It will be appreciated that the approaches of FIG. 5 do not use anallocation table. More specifically, no allocation table is used and theanalysis described is performed on-the-fly as the information isreceived at the mobile unit. On the other hand, the information receivedin the Neighbor Cell List may be used to populate an allocation tableand the sensed reading of the channels (by the mobile unit) may also beused to populate the table. In this later approach, the approachesdescribed herein may be used to access the information in the table andto make a determination as to whether a candidate base station is acloned base station.

Thus, approaches are provided where a cloned base station is detectedand its detection is reported to an appropriate entity or authority sothat action can be taken. The approaches described herein are accuratein determining whether the base station is actually a cloned station,and timely in that they allow for the detection of a cloned base stationbefore a vehicle and/or its contents can be stolen. The approachesdescribed herein can easily be retrofitted into existing systems therebyavoiding the need for costly re-wiring or re-working of the system.

Those skilled in the art will recognize that a wide variety ofmodifications, alterations, and combinations can be made with respect tothe above described embodiments without departing from the spirit andscope of the invention, and that such modifications, alterations, andcombinations are to be viewed as being within the scope of theinvention.

1. A method of detecting the presence of a cloned base stationcomprising: establishing and engaging in communications with a basestation; analyzing the content of at least some information receivedfrom the base station relating to neighboring cells; when the analyzingindicates that the base station is a cloned base station, initiating awarning to the user.
 2. The method of claim 1 further comprising storingan allocation table in a memory storage device, the allocation tableincluding information related to the operating environment of a user andwherein the analyzing comprises analyzing a content of the allocationtable and determining when the base station is a cloned base stationbased upon the analyzing.
 3. The method of claim 1 wherein the at leastsome information comprises a Neighbor Cell List and the analyzingcomprises determining a first power level of at least one channelincluded with the Neighbor Cell List and determining when the basestation is a cloned base station based upon the analyzing.
 4. The methodof claim 3 wherein the analyzing comprises initiating a warning when thefirst power level of the at least one channel is substantially zero. 5.The method of claim 3 wherein the analyzing comprises determining asecond power level of the current serving cell and only initiating awarning when the second power level of the current serving cell is abovea predetermined level and the first power level of the at least onechannel is substantially zero.
 6. The method of claim 1 wherein the atleast some information comprises a Neighbor Cell List and the analyzingcomprises determining whether a Neighbor Cell List has been received andinitiating a warning when the Neighbor Cell List has not been received.7. An apparatus for detecting the presence of a cloned base stationcomprising: a communication interface configured to establish and engagein communications with a base station; a memory coupled to thecommunication interface, the memory comprising an allocation table, theallocation table including information related to the operatingenvironment of a user; a warning indicator; a controller coupled to thecommunication interface, the memory, and the warning indicator, thecontroller being configured to analyze a content of the allocation tableand to determine when the base station is a cloned base station basedupon the analyzing, the controller further configured to, when theanalyzing indicates that the base station is a cloned base station,initiate a warning to the user via the warning indicator.
 8. Theapparatus of claim 7 wherein the controller is configured to determinethat the base station is a cloned base station when no neighboring cellexists in the allocation table.
 9. The apparatus of claim 7 wherein theoperating environment includes at least one neighboring cell and whereinthe controller is configured to determine when at least one signalstrength value associated with the at least one neighboring cell is asuspect value.
 10. The apparatus of claim 9 wherein the controller isconfigured to determine that the at least one signal strength value is asuspect value when the at least one signal strength value increases at arate greater than a predetermined threshold rate.
 11. The apparatus ofclaim 7 wherein the base station is a valid base station and wherein thecontroller is configured to establish communications with a cloned basestation subsequent to establishing communications with the valid basestation.
 12. The apparatus of claim 7 wherein the warning indicatorcomprises an audio speaker.
 13. A computer usable medium having acomputer readable program code embodied therein, said computer readableprogram code adapted to be executed to implement a method of detectingthe presence of a cloned base station, the method comprising:establishing and engaging in communications with a base station;analyzing the content of at least some information received from thebase station relating to neighboring cells; when the analyzing indicatesthat the base station is a cloned base station, initiating a warning tothe user.
 14. The computer usable medium of claim 13 further comprisingstoring an allocation table in a memory storage device, the allocationtable including information related to the operating environment of auser and wherein the analyzing comprises analyzing a content of theallocation table and determining when the base station is a cloned basestation based upon the analyzing.
 15. The computer usable medium ofclaim 13 wherein the at least some information comprises a Neighbor CellList and the analyzing comprises determining a first power level of atleast one channel included with the Neighbor Cell List and determiningwhen the base station is a cloned base station based upon the analyzing.16. The computer usable medium of claim 15 wherein the analyzingcomprises initiating a warning when the first power level of the atleast one channel is substantially zero.
 17. The computer usable mediumof claim 15 wherein the analyzing comprises determining a second powerlevel of the current serving cell and only initiating a warning when thesecond power level of the current serving cell is above a predeterminedlevel and the first power level of the at least one channel issubstantially zero.
 18. The computer usable medium of claim 13 whereinthe at least some information comprises a Neighbor Cell List and theanalyzing comprises determining whether a Neighbor Cell List has beenreceived and initiating a warning when the Neighbor Cell List has notbeen received.